# Xml plugin getting text with characters **URL:** \ **Category:** Logstash\ **Created:** [May 9, 2019, 2:58pm UTC](https://discuss.elastic.co/t/xml-plugin-getting-text-with-characters/180389 "2019-05-09T14:58:32Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![bigster](https://avatars.discourse-cdn.com/v4/letter/b/8e7dd6/32.png) [@bigster](https://discuss.elastic.co/u/bigster)\ **Post date:** [May 9, 2019, 2:58pm UTC](https://discuss.elastic.co/t/xml-plugin-getting-text-with-characters/180389/1 "2019-05-09T14:58:32Z")
Hi, I'm getting the XML values from a QUEUE and when i get an element that have the '&' character it transforms into the & string. Here are the before and after: > gz$LDQ@vnbkj7DNUVwwjrnGa0&|2,a) > gz$LDQ@vnbkj7DNUVwwjrnGa0&|2,a) Here are the code of the filter, the field in question is the service\_key: > xml{ > source =\> "message" > store\_xml =\> false > remove\_namespaces =\> true > force\_array =\> false > xpath =\> [ > "/LogMessage/TransactionID/text()", "transaction\_id", > "/LogMessage/ServiceKey/text()", "service\_key" > ] > } Any ideas why this happens and how can i resolve this? Cheers, ---
**Author:** ![bigster](https://avatars.discourse-cdn.com/v4/letter/b/8e7dd6/32.png) [@bigster](https://discuss.elastic.co/u/bigster)\ **Post date:** [May 9, 2019, 3:01pm UTC](https://discuss.elastic.co/t/xml-plugin-getting-text-with-characters/180389/2 "2019-05-09T15:01:39Z")
Strange the field after passing to the interpreter of the browser, is correct. The second value instead of a '&' it has the '&'. This field is used after in a jdbc\_streaming plugin and it has the wrong value. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 9, 2019, 3:26pm UTC](https://discuss.elastic.co/t/xml-plugin-getting-text-with-characters/180389/3 "2019-05-09T15:26:27Z")
I do not see any difference between the before and after. You may need to use appropriate markdown to quote your examples. ---
**Author:** ![bigster](https://avatars.discourse-cdn.com/v4/letter/b/8e7dd6/32.png) [@bigster](https://discuss.elastic.co/u/bigster)\ **Post date:** [May 9, 2019, 4:12pm UTC](https://discuss.elastic.co/t/xml-plugin-getting-text-with-characters/180389/4 "2019-05-09T16:12:28Z")
This is what i get from the XML: ``` "service_key" => "gz$LDQ@vnbkj7DNUVwwjrnGa0&|2,a)", ``` and instead of `&` it should be '&' ---
**Author:** ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Post date:** [May 9, 2019, 4:24pm UTC](https://discuss.elastic.co/t/xml-plugin-getting-text-with-characters/180389/5 "2019-05-09T16:24:22Z")
You could always setup a mutate pass on the field and use gsub to replace `&` with `&` ```auto mutate { gsub => [ "service_key", "&", "&" ] } ``` ---
**Author:** ![bigster](https://avatars.discourse-cdn.com/v4/letter/b/8e7dd6/32.png) [@bigster](https://discuss.elastic.co/u/bigster)\ **Post date:** [May 10, 2019, 2:04pm UTC](https://discuss.elastic.co/t/xml-plugin-getting-text-with-characters/180389/6 "2019-05-10T14:04:55Z")
Hi, The problem using that is that i can't predict that's the only character that needs to be treated. There's no other way of doing something in the XML filter plugin? ---
**Author:** ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Post date:** [May 10, 2019, 2:55pm UTC](https://discuss.elastic.co/t/xml-plugin-getting-text-with-characters/180389/7 "2019-05-10T14:55:03Z")
The source of the problem is the parsing engine the XML plugin uses and it's mistreatment of a special character. You can safely assuming that alphanumeric characters wont have this occur, and based on your current results, $@ are safe as well. All that in mind, unless we get some input from the plugin dev (open a ticket on github?), you could perform a test ingest of each special character and then add to the mutate rule for those that are improperly parsed. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 10, 2019, 3:41pm UTC](https://discuss.elastic.co/t/xml-plugin-getting-text-with-characters/180389/8 "2019-05-10T15:41:58Z")
If you have HTML entities in a string then there is a third-party [filter](https://github.com/synlay/logstash-filter-htmlentities) that can remove them. ---
**Author:** ![bigster](https://avatars.discourse-cdn.com/v4/letter/b/8e7dd6/32.png) [@bigster](https://discuss.elastic.co/u/bigster)\ **Post date:** [May 16, 2019, 5:49pm UTC](https://discuss.elastic.co/t/xml-plugin-getting-text-with-characters/180389/9 "2019-05-16T17:49:42Z")
The solution wasn't pretty, but solves the problem. ---
**Author:** ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Post date:** [May 17, 2019, 4:09am UTC](https://discuss.elastic.co/t/xml-plugin-getting-text-with-characters/180389/10 "2019-05-17T04:09:13Z")
What was your solution, a mutate filter? ---
**Author:** ![bigster](https://avatars.discourse-cdn.com/v4/letter/b/8e7dd6/32.png) [@bigster](https://discuss.elastic.co/u/bigster)\ **Post date:** [May 17, 2019, 10:02am UTC](https://discuss.elastic.co/t/xml-plugin-getting-text-with-characters/180389/11 "2019-05-17T10:02:34Z")
The solution that you provided in the first place, a mutate filter with a lot of characters to be gsubed. cheers, ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 14, 2019, 10:02am UTC](https://discuss.elastic.co/t/xml-plugin-getting-text-with-characters/180389/12 "2019-06-14T10:02:36Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.